CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Google Chromium V8 Out-of-Bounds Read Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
Affected products
debian: debian linux; canonical: ubuntu linux; google: chrome; suse: package hub; opensuse: leap; opensuse: opensuse; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux server; redhat: enterprise linux workstation
References10
- googlechromereleases.blogspot.com/2016/03/stable-channel-update… Release NotesVendor Advisory
- googlechromereleases.blogspot.com/2016/03/stable-channel-update… Release NotesVendor Advisory
- codereview.chromium.org/1804963002/ Patch
- codereview.chromium.org/1804963002/ Patch
- code.google.com/p/chromium/issues/detail?id=594574 ExploitIssue TrackingMailing List
- code.google.com/p/chromium/issues/detail?id=594574 ExploitIssue TrackingMailing List
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.… Mailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.… Mailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.… Mailing ListThird Party Advisory
- rhn.redhat.com/errata/RHSA-2016-0525.html Third Party Advisory
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 48% percentile: 99 · as of 8 November 2026
- CWE
- CWE-125
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.